flexaccess.dev

flexaccess.dev / flextunnel

flextunnel

The rootless split tunnel for private TCP services.

Access level
TCP via local SOCKS5 / HTTP proxy listeners
Privileges
None — no root or admin on either end
DNS
Resolved on the server's side of the network
Authentication
Per-client Ed25519 keys, authorized-keys style
Coexistence
Runs alongside another VPN, including on iOS

flextunnel gives you proxy-level access to hosts behind a server — without a VPN. The client runs local SOCKS5 and HTTP proxy listeners; targets on the server-pushed tunnel list are carried over an encrypted QUIC connection to the server, which resolves DNS and makes the outbound TCP connection from its own network. Everything else connects directly from your device.

Because it uses ordinary userspace sockets — no TUN device — neither the client nor the server needs root or admin rights. And because it isn't a VPN, it sidesteps iOS's one-active-VPN-at-a-time restriction and runs happily alongside one.

Every connection is gated by a per-client Ed25519 keypair in the shared flexaccess-keys format; the server keeps an ssh-style authorized-keys file of the clients it admits. For a throwaway session, --quick skips key files and config entirely — each side just types in the other's endpoint ID.

How it works

local app ──SOCKS5/HTTP──▶ flextunnel client   (127.0.0.1 · no root)
                               │  one encrypted QUIC connection
                               ▼
                           flextunnel server   (no root · no open port)
                               │  resolves DNS, connects from its own network
                               ▼
                           target host:port

Features

  • SOCKS5 & HTTP proxy

    The client runs local SOCKS5 and HTTP proxy listeners on 127.0.0.1 — point any proxy-aware app at them and its connections to private targets ride the tunnel.

  • Zero privileges

    Ordinary userspace sockets on both ends — no TUN device, so no root, no admin, no elevation prompts. The installer puts the binary in ~/.local/bin.

  • Server-side DNS & host aliases

    Reach names that only resolve on the server's network — or the server's own localhost. The server can also map friendly names like server.internal to addresses on its network.

  • Split by default

    Only targets on the server-pushed tunnel list go through the tunnel; everything else connects directly.

  • Local port forwarding

    Bind a local port to any host:port on the server's network, so tools that can't use a proxy reach private services as if they were local. Manage forwards live from the client control panel.

  • Server-to-server bridges

    Chain servers together: one server forwards matching targets over a persistent, authenticated connection to another, which resolves and dials them from its own network — split-tunnel routing that reaches networks a single server can't. Single hop, so mutual bridges can't loop.

  • Quick ephemeral tunnels

    flextunnel server start --quick and client start --quick: no key files, no config. Each side enters the other's endpoint ID, the session full-tunnels for as long as you need it, and nothing is persisted.

  • No inbound ports

    The same dial-by-identity transport: the server needs no public IP and no port forwarding.

  • Coexists with VPNs

    It isn't a VPN, so it runs alongside one — sidestepping iOS's one-active-VPN-at-a-time limit.

  • Per-client keys

    Every client authenticates with its own Ed25519 keypair, signed into the handshake so a captured handshake can't be replayed; whoever runs the server decides which public keys get in.

  • Built-in status page

    From any connected client, http://flextunnel.internal shows the server's live status as a page or JSON — always tunneled, regardless of the routed set.

Install

Linux / macOS
curl -sSL https://flexaccessdev.github.io/flextunnel/install.sh | bash
Windows (elevated PowerShell)
irm https://flexaccessdev.github.io/flextunnel/install.ps1 | iex

No root needed to run: on Linux/macOS the installer places the binary in ~/.local/bin. Prebuilt binaries cover Linux amd64/arm64, Apple Silicon macOS, and Windows amd64; a container image is published at ghcr.io/flexaccessdev/flextunnel. Client keys are generated with flexaccess-keys. Set up flexaccess-keys

Apps & repos

  • client and server CLI
    flextunnel

    The core — command-line client, server, and live control panel for Linux / macOS / Windows.

  • macOS / Windows GUI client
    flextunnel-desktop

    A menu-bar / system-tray app for macOS and Windows: multiple concurrent profiles, per-profile SOCKS5 / HTTP listeners and port forwards, connection-path view. Shipped as a .dmg and .msi with every stable release.

  • iOS client
    flextunnel-ios

    Browse private networks in a built-in split-tunnel browser, or forward local ports so other apps — SSH, RDP, databases — can reach them. No VPN profile required.

Good for

  • Web UIs, SSH, RDP, and databases that are only reachable from the server's network
  • Shared or locked-down machines where you can't get admin rights
  • Running next to a corporate or personal VPN — including on iOS
  • A five-minute throwaway tunnel to a box you're sitting at — with --quick
View flextunnel on GitHubCompare with ezvpn